CVE-2026-40211

Name of the Vulnerable Software and Affected Versions The product name cannot be determined (affected versions not specified)

Description An attacker can send crafted DNS over HTTP/3 queries to trigger an exception that prevents a buffer from being freed immediately. While the buffer is eventually released at the end of the QUIC connection, certain configurations may allow the opening of enough concurrent DoH3 streams to cause an out-of-memory condition, leading to a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.